Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
55 detections
Filters
Last updated
All Time
Detection languages
20
13
8
4
4
Contributors
11
10
8
6
5
Categories
34
25
21
9
7
Platforms
55
6
5
2
Products / Services
18
15
10
4
3
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
2
IDS Protocols
4
Detects the use of the Windows command-line utility 'reg.exe' to query sensitive registry keys or paths commonly associated with credential storage, such as SAM, SECURITY, LSA secrets, or autologon configurations. This activity is often indicative of reconnaissance or credential harvesting attempts.
Detects the use of the Windows command-line utility 'reg.exe' to query sensitive registry keys or paths commonly associated with credential storage, such as SAM, SECURITY, LSA secrets, or autologon configurations. This activity is often indicative of reconnaissance or credential harvesting attempts.
This rule detects potential registry enumeration activities targeting sensitive Windows system keys ('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' or 'HKLM\HARDWARE\DESCRIPTION') that are associated with the execution of suspicious processes named 'systemki.exe' or 'sysklnd.exe'. These filenames are consistent with historical observations of the Sauron (also known as Strider) malware framework.
This rule detects attempts to query the Windows Registry remotely for the 'HKLM\Software\RealVNC' key over TCP port 445 (SMB). This activity is indicative of an attacker attempting to locate stored credentials, specifically those related to RealVNC, which could then be used for further lateral movement or privilege escalation. The detection is based on the presence of the string 'HKLM\Software\RealVNC' in the network traffic.
This rule detects attempts to read AutoLogon credentials from the Windows Registry over the network, specifically targeting SMB (port 445) traffic. It looks for the strings 'DefaultPassword' and 'Winlogon' in a case-insensitive manner within the TCP payload, indicating a potential attempt to extract stored credentials used for automatic login.
Attackers distributed a malicious MSI installer disguised as a legitimate Sysinternals tool. Once executed, it installed EtherRAT, a Node.js-based remote access trojan. EtherRAT then deployed TukTuk C2, a framework designed to abuse SaaS services (Supabase, ClickHouse, Dropbox, GitHub Issues) and Cloudflare tunnels for resilient command-and-control.
Ref: https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/
Ref: https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/
Detects execution of suspicious tools or commands that may indicate credential or secret discovery. Generic detection for processes attempting to enumerate credentials, secrets, or sensitive information across files, repositories, or environments.
Detects scenarios where a security policy is exported to a .cfg file using secedit.exe and subsequently accessed/reviewed using notepad.exe on the same Windows host. This activity may indicate reconnaissance or staging for privilege escalation or lateral movement by a threat actor.
Detects handles requested to SAM registry hive
Detects remote registry management attempts using the 'reg' utility originating from a workstation not designated as an administrator workstation. This could indicate an attacker attempting to query or modify the registry of a remote system from an unauthorized host.
The analytic detects unauthorized access to Outlook credentials stored in the Windows registry. It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles. This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts. If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk.
KQL Query from file: DefenderXDR - Devman Ransomware Detection
Detects processes that query known 3rd party registry keys that holds credentials via commandline
Detects processes that query known 3rd party registry keys that holds credentials via commandline
Remote registry management using REG utility from non-admin workstation
Detects the use of reg.exe to export registry paths associated with third-party credentials.
Credential stealers have been known to use this technique to extract sensitive information from the registry.
Credential stealers have been known to use this technique to extract sensitive information from the registry.
Detects the use of reg.exe to export registry paths associated with third-party credentials.
Credential stealers have been known to use this technique to extract sensitive information from the registry.
Credential stealers have been known to use this technique to extract sensitive information from the registry.
This query was originally published in the threat analytics report, WDigest credential harvesting.
WDigest is a legacy authentication protocol dating from Windows XP. While still used on some corporate networks, this protocol can be manipulated by attackers to dump system credentials.
The Microsoft Security Response Center published an overview of KB2871997, which addresses WDigest use on older platforms. More recent versions of Windows can be protected with a holistic security approach that follows the principle of least privilege.
The following query returns any attempts to turn WDigest credential caching on through the registry.
References:
https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc778868(v=ws.10)?redirectedfrom=MSDN
https://msrc-blog.microsoft.com/2014/06/05/an-overview-of-kb2871997/
https://www.catalog.update.microsoft.com/Search.aspx?q=KB2871997
https://docs.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models
WDigest is a legacy authentication protocol dating from Windows XP. While still used on some corporate networks, this protocol can be manipulated by attackers to dump system credentials.
The Microsoft Security Response Center published an overview of KB2871997, which addresses WDigest use on older platforms. More recent versions of Windows can be protected with a holistic security approach that follows the principle of least privilege.
The following query returns any attempts to turn WDigest credential caching on through the registry.
References:
https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc778868(v=ws.10)?redirectedfrom=MSDN
https://msrc-blog.microsoft.com/2014/06/05/an-overview-of-kb2871997/
https://www.catalog.update.microsoft.com/Search.aspx?q=KB2871997
https://docs.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models
Adversaries may search the Registry on compromised systems for insecurely stored credentials.
The Windows Registry stores configuration information that can be used by the system or other programs.
Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services
The Windows Registry stores configuration information that can be used by the system or other programs.
Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services
Detects handles requested to SAM registry hive
Adversaries may search the Registry on compromised systems for insecurely stored credentials.
The Windows Registry stores configuration information that can be used by the system or other programs.
Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services
The Windows Registry stores configuration information that can be used by the system or other programs.
Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services
Page 2 of 3